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(54) User authentication across multiple telecommunications network 



(57) Authentication of a voice channel user terminal 
UT 1 , for a packet data communications network pro- 
vided by a satellite telecommunications system, is 
achieved by using data from a SIM card associated with 
the user terminal and corresponding authentication 
data held in an authentication centre AuC associated 
with a conventional GSM network used for voice chan- 



nel communications with the user terminal. The authen- 
tication data is communicated from the GSM network to 
the satellite packet data network and authentication is 
carried out in a network adminstration station NASS or 
an interworking function unit IWF between the networks 
or at a satellite network MSSC. 
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Description * ;1 ... -/ stituted by s single: algorithm producing a 96 bit output * 

r-;. -r.i.. . • -.-^'ii.-a :s..-Si -ru ^ ' of which 32 bits.constituts SRES and^the remaining 64 

This -invention -relates to authenticating "'a mobile*'-' '= bits constitute. Ka Atripletof.sighals comprising RAND,- ■ 
user terminal tof morethan one- telecommunications ' t: SRES and Kc is.fed from the AuC, thrown* the HLR to 
network and has particular but not exclusive application 5 - the MSC,; which acts as -a 1 checking, station * in the 
to a satellite 'telecommunication network for providing , authentication procedure. 

telecommunication coverage to mobile" user terminals, ' The individual value of RAND is then transmitted on 
such as mobile telephone handsets. \---r •. v* to the user terminal through the network from the MSC. 

Terrestrial mobile telecommunications systems are m: r- The SIM -'of 'the user terminal has the algorithm A3/A8 
well known- and: a number of different ^systems have.. ' to stored locally, 1 so as to generate a corresponding value 
developed, which operate according/to different stand- . . : of SRES' ar.d Kc at the user ti. .Tiinal; from the received 
ards. These public, land mobile networks (PLMNs) may * > . =: value o/ the random number RAHD andihe stored value 
operate: according +o . analog or. digital standards: In - of Ki in the SIM. 

Europe, the Far East, excluding Japan and elsewher?,. c . :■ The value of SRES' is transmuted back through the 
the digital Glcbal System Mobile (GSM) network' has ,is network to 'the MSC and compr^ed with the originally: 
become. popular, whereas in USA, the Advanced Mobile :- r generated value of SRES. If they are the same, tho user 
Phone System (AMPS) and the;Digital American Mobile -i.terminal.js authenticated but otherwise registration of 
Phone System (DAMPS) are used, whereas in Jepau, . : the user terminal with Ihe HLR is barred. ' 
the Persor;a|vHandiphone:System (PHS)-.anc! the Per-. ;, v : , Thereafter, if the user.terminal is authenticated the 
sonal Digital Communication (PDC) network are in use. 20 \. MSC initiates encryption/decryption of data transmitted 
More recently, proposals have been made for a Univer- > • - over the: network, using ah enciphering/deciphering .. 
sai Mobile Teiecommunicaiions.Systerri (UMTS). These ? >■ algorithm referred to in the* GSM Specifications as AS; 
networks are.a'I celluiar.and land-based; -*■ <"> ' • which uses as its inputs the secret key Kc and the frame v . 

Considering for example the GSM system, irtdivid> number .of data transmitted through; the network. The : 

ual cells of the mobile: network are served by a series of 125 SIM of the user terminal grinoratcsits own value of the 
geographically spaced, ..terrestriahbase transceiver sta-~ - secret key Kc using its locally stored copy of the algo^ 
tions (BTSs)whichare .coupled through base switching - ; rithm A8. The local value of Xo a 'the -user terminal can - 
centres - (BSGs), .to -,a mobile . switching : centre (MSG) then be used to encrypt/doer ypt data transmitted, using . 
which may provide , a gateway out of the network to? ar a locally held copy of the algorithm A5. . ■ 

conventional public switched telephone- . n-Mwotk-;. 30 ■ The -authentication procedure, used in GSM has the u 
(PSTN): The network includes a home location register- advantage -that only random numbers ars' transmitted" • ' 
(HLR) which stores informaiioaabout the subscribers to over the' air interface between ihe user terminal and the* 
the system and their user terminals. When a user termi- BTS, which minimises the risk.or. fraudulent registration, 
nal is switched on,, it, registers with the HLR arid an ■-. ■ For further details of the authentication procedure 
authentication procedure is carried-,oirt. Each mobile '35 and subsequent data encryption'decryption, reference 
user terminal js provided with a smart card known as a is directed to The GSM Systsrrvfor Mobile Comrnunica-. ! 
subscriber identification module (SIM) which stores . two ■ tions" M: Mouly a M-B. Patrtet, G&il 8. Sys.1992 pp 477^ - ; 
unique items of identificrtiort in order to identify the sub- v v 492. ;: : -~ -v.- y, \ 

scriber. The first item comprises an international mobile-: If the u:;er terminal roams to: a different GSM net- 

subscriber, identity ;( IMS!) and second item comprises a 40. work, in a/different geo^ uphiua: location, it registers 
secret parameter. referred to jn the GSM specifications ' with a visitor location register :(VLR) ef the visited net- 
as Ki. Associated with the HLR is an authentication cen- - : ■- work, which; communicates with the HLR: of the home 
tre (AuG) which includes dsta.correspondingto the IMSI . network for billing and other purposes/ DAMPS, PHS . 
and Ki for- each subscriber to .the network. When the -.' and PDC networks include- similar location registers. • - '> - 
user terminal is switched on, and sV othe: times,, the- as Prior ^analog PLMEMs have supported- 'a digital t 
IMSI is. transmitted from the user terminal toihe HLR, - . packet data service which can be used to transmit fac- 
which then refers to the AuQjn order ;o authenticate the -1 simile and c-mail messages to and from mobile user ter- 
user. The IMS! is checked in the memory o? the" AuC, r v minals.- For example, AMPS networks can support the - 
and a correspondingvalue of KU* retrieved. Also, a ran-' /^Cellular D.igitc! Packet Data (CDPD) protocol -which, 
dom numben-RAND is. generate/ ircthe AuG: The rah- sc.. allows data packets to ba transmitted during gapsin the 
dom number RAND and the value of Ki a; e applied as : ■ voice transmission. For a more detailed description of ; m : 
inputs to an algorithm referred-: io in the GSM. Specifica- " the CDPD system 1 reference is directed tOv"Cellular Dig- ; - 
tions as A3 to generate a sgn»:^ result SRES. The AuC ; r ital Packet Data" M.. Streetharan and R. Kumar, : Artech 
also includes an algorithm referred to. in the GSM Spec- - • House Publisher, 1996 (ISBN-0-89006^709-0). Hdw- 
ifications.as AS v/hich ger : :ratps a secret k;-y Kc that is - 55 ever current digital PLMNs such as DAMPS and GSM 
used forencryption/decr.yption of data. transmitted over - B . , . suffer fromi.the disadvantage. that they- do not support 
the air between. f the- user ^terminal, and -the landbased z ■:: such a digital packel data service. t w ..- :-v ■ 

network. In- practice t vths,algoi"ithms A3/A8 mpy.be con- . - Mobile telecommunication systems have beenpro- 
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posed that use satellite communication links -between. :. .^ through the satellite network and others through the ; 
mobile user terminals arid conventional; terrestrial net- : > . . PLMN. For example, digital land based networks such 
works such as PSTNs and PLMNs. One.hetwork known. .... e 1 'as GSM and Ijke, do not,, currently^upport: a digital ■ 
as the IRIDIUM™ satellite'cellular systerri isidescribed " I. packet data,service,. : so itv.would be [convenient to. use 
in EP-A-0365885 and . \JS. -'PatenfcNo. . 5 394'561'-5''"-the ; sate!lite -netwprk:as an extensiq^of:the PJJvlN in 
(Motorola), which makes use of a constellation of so j = ■>'■ order to use the digital.packet data network proyidedby -r 
called low ; earth ort)it^LEO) v :satelHtes, ..that. : haye an- ; ; the satellite network for date transmission .: — ■ ^;i;r 
orbital radius of ; ,780 KnvMobile user terminals suoh as r : c/ The present invention concerns authentication :ofa 
telephone ihandsetSi establishr a;; link to an L overhead!3 sr - l user terminal for operation wrth:rnore:than one network; T 
orbiting satellite, from.whieh^a^eallrcan'be directed; to Vmr. , for example, so that-voice channel communication "can- 
another satellite in tr^constellai&n -and then-typically to^- . >>be carried out through one telecommunicationsJietwork . - 
a ground station which/is .connected'. Jo : conventional- |; . ;suC h as a digital. PLMN, and digttalpacket datacommu- 
land-based networks. r-c . ; > onication can be: carried, through another -network such i : T 

Alternative. schemes.^wriich make tise 61 so-called * as a satellite networto n: :;: i o-x t 

medium earth,orbrt (MEO) satellite:cbnstellation& l >have - is.' Broadly 5 stated, the 'invention provided method^oV' ' 
been proposed with an orbital radiusTn^he-range'ot 10- authenticating a^mobile user terminaLfor use with a^first 
20,000 knuand reference Js directed -'to "-Walker J.G. .... or a second mobile, network providing "coverage^n- a- JC 
"Satellite Patterns for Continuous.Multiple Whole* Earth. . .-common area for communication withithe user terminal, 
Coverage" Royal .Aircraft- Establishment^. 'pp 1 :it9-1£2. " wherein the~user (terminal iSv6perable-'a<JCordihg'to~ : a^ 
(1977)^Reference is directed.to the' ICO™ xsateilite eel-. 20 , predetermined, authentication procedure 'which" makes^ > ' - 
lular system described for;example in GB-A-2 295 296;. use of an- individual identification code held- irr-Jhe user- : =■> 1 
and to.Vthe ODYSSEY™; satellite cellular system , o. ' terminaiarid'a^ 

described.in EP-A-.OBIG^S^With.these.Bystems^he a remote authentication centreline method comprising: ' 

satellite communication iinfcdoes not permit communis ~ :i accessing the authentication cehtrefthrougrra selected- 
cation between adjacent^satellitesand instead, a signal .25'.- one of the networks to- retrieve authentication data cor- ; : 
from a mobile user terminal suchasa mobile handsetis - responding to the identification code st6red;in : th&user . -j } 
directed firstly to -the satellite and, then directed to a -f terminal;r'and performing. an authentication' of-'.the : user 1 
ground station or satellite •accessf=-nodev(SAW), conr . .-»! 1 terminaCtothe selected network^using the authentica- - 3- 
nected to conventional land ; based telephone network^ ■■■■ < tion data: retrieved from the authentication' centre 'and ■ <iw 
This has 1 ;the,advantage : tha^many:compbnentS'.of'the so data from the user terminal. \^;~:\^-'. "X :> 1 r 
system are compatible with^known digital terrestrial ce> .v The first network may support transmission of sigr • 
lular technology, such as; GSM. .'Also simpler, satellite nals in a first-mode ^uch^as-voice'SignatShand-thesec- ' 
communication, techniques, .can toe used than with^a- : ■ ond network may. support transmission. of signals in a- - - 
LEO network.- . ;i-;.-'>,'.jv. 3- * ■ second mode such! asdigitaipacket.data signals."-- ^' 

In satellite communications. 5 networks, . ground sta- • 35 ,t The invention also provides ^telecommunications - ■ ^ 
tions are located at different'sites around the "world =in system including^: first and -a second :mobile networks -' 
order to communicate,with. the orbiting sateilites.'lh the" providing coverage in>a.common area':fot--cdmmunica- ^ < 
ICO™ system and others, a visitor location register is tion wittva mobile user terminal operabTe^accordintj to a ; 
associated with -eachi.of the- satellite ;ground stations, predetermined authentication. procedure which* makes- - 
which maintains a record ofrthe^n^ividual usentermir 40 use of an individual identification ^ode^eld in the user - v - ' 
nals that are making: use, of the particular, ground sta- < • * terminal; anvauthenticatibn^entre that includes authenT - ; 
tion. It haabeen proposed that satellite communication . . tication data '..corresponding- to the identification 'code ^ 
networte provide-a digitalsatellitepacketdata networks, -n stored ih theiuser terminalrmeans. for' directing data ~ 
(SPDN) to allow e-mail,, fax' and transmission: of mother * - r- from the user terminal-corresponding \o the identifica-' -r 
data. For example, ithe ICO™, system: is configured to '45 tion code either froimthe4irst:network or the Second net- - ' 
support such a packet data network ' ' ^ * work to' ;the ^authentication ^centre- to retrieve ithe 

In certain areas of the world; Coverage providedby : authentic&tion;:data coreesponding to. the identification 
a conventional terrestrial PLMN and ' the satellite net- > code; and mea'ns for performing ah authentication of the T > 
work will overlaps in a cbmrtion area. It has-been pro- • * user terminal - for the^ selected .network, fusing the - 
posed that the individual mobile terminals be operable 50/-. authentication ~data"^retrievet&fromi the: authentication • 
with both thePLMN^and'the satellite network The user . centre and data from the user ^terminal'. ■' I- 
terminals may include -a switch to allow the user to i. The invention also provides-a method'^ authenti- • : 
select the- network: or alternatively; an automatic selec- " ~< eating a user terrriihatcommun^ation^ith'a first mobile^ ■ 
tion may be made e.g. onthe basis. of signal-strenigth. 'It - ■ network; wherein the user terminal is'operable with : a ^ : 
is envisaged 1 that normally. th&:converiti6hal terrestrial . 55 second mobile.network which proviaes;overlapping cov- . 
network will be preferred for reasons of-costand signal erage with thefirst network and^ses'avfiredetermined'' . :■>'. 
strength. However, for some PLMNs it would be conven- * / authentication procedure forthe>user^errrtinal; thepro-'i- : * 
ient to provide, some .services for. the' user terminal * cedure:making.use of-an individual 'identification: code 
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held in the user: terminal and a corresponding identifica: 
tion code held ai a location >in the .second .network,, the; 
method comprising: accessing the second network from 
the first network ito .retrieve : authentication data .cprre-:, 
spending, to JheHdentificationjcode held:atsaid location 
in the second network;, and. performing 1 an authentica*:. 
tion of.the user terminal. in- the f irst network^using the- 
authentication data .retrieved from -the ;second network 
and data from the mobile terminal. ;:• * , >. 

The first network may comprise a satellite telecom- 
munications network and the second network may com- 
prise a RLM.N. Mv : . a: . . * .• ' ■ ■ r' " 

The present invention may make use.of an authen- 
tication,;procedure for a voice network to authenticate 
communication;thrpugh a digital packet data network: 

Mere specifically, the-:inyention includes a method 
of authenticating a mobile user terminal for use witrva 
digital packet data network, wherein the user terminal is 
operable for- voice channel communication with a mobile 
network which uses, a predetermined, authentication 
procedure for the voice channel, the-procedure. making- 
use of an ; : individuals -identffication^code held in the 
mobile terminal and a corresponding identification code 
held at a location in the network that provides the voice 
channel, the method comprising:. : 



accessing 'the mobile network^ that provides the 
voice channel, from the digital packet data network 
to^retr;eve,authentication data, corresponding to the 
identification code hejd .--at ; sad , location in the 
mobile network. that provides the voices-channel; 
and 

performing an authentication, of theuser terminal- in 
the; digital packet ;data network, using the authenti- 
cation data retrieved from -the mobile network and 
data from the mobile terminal. 

The digital packet data network may utilise a satel- 
lite communication link to the mobile user terminal, and 
the voice channel may be provided by a land based 
public mobile network/ for; example a GSM network. 

The method according to the invention may include 
transmitting identification , data -.corresponding to the 
identification code held sat the user terminal, from the 
terminal to the digital packet data network; ..routing the 
identification data from the .digital packet data network 
to an authentication ..centre in the^voice network; deriv- 
ing the authentication data from the authentication cen- 
tre in response .to the identification data;' interrogating 
the mobile . terminal for data corresponding to authenti- 
cation data; and comparing data derived from the termi- 
nal ia response' 1 to : .;the>^. interrogation i jwilh the 
authentication data, Jo deia.rniine whether the terminal 
may. be used on -the. dig jta! packet data network. 

ln.order.that the-jnyentjon may be more fully under- 
stood an embodiment thereof will now be;described by 
way of example, -with. reference <to- the accompanying 
drawings, in which^c-o^ ; . 



Rgure .1 is a schematic diagram of a satellite tele- 
.-, , communications system -together with a local, land- 
' •^ based, .mobile ; telecommunications system, in 

accordance with the invention; 

, s '-if Rgure 2 is a more detailed block diagram of the sat-, 
ellite network in the vicinity of SAN I and the asso- 
ciated terrestrial cellular network, for illustrating 
~r. interworking; 

■■■■■ ~ Rgure 3 is a schematic block diagram illustrating 

"-■10 • . intercommunication within the satellite network; 

Figure 4 is- a schematic diagram of a mobile user 
terminal; . ^ * 

Rgure 5 is a schematic block diagram of the circuits 
of thetermsna! shown in Figure.4; 
is** Figure. 6 is a ; schematic block diagram of the SIM 
card shown in Figures 4 and 5; 
Figure 7 is a schematic diagram of data flows asso- 
ciated with authenticatipn.of the. GSM, PLMM-9;; 

/. .■- Figure 8 is a schematic illustration of a first embod 7 

so, iment of an authentication procedure for the SPDN; 
Figure 9 is a schematic illustration of a second 
embodiment of an authentication procedure for the 

SPDN; , ; 

Figure 10 is a ^schematic illustration of .a third 
- -25.- embodiment of an authentication procedure for the 
SPDN;. and . - ... - r ■ 

Figure -1 1- illustrates schematically the transmission 
■ • . of . data between various components in the net- 
works for the authentication procedure. 

Satellite Network ,y 

Referring to Rgure 1 schematic block diagram of 
a satellite mobile telecommunication network is shown 

35 corresponding generally to thelOO™ network. A mobile 
user terminal UT 1 in the form of a mobile telephone 
handset can .communicate on , a radio channel over a 
communication path \1, 2 via an earth orbiting satellite 
3a with a. iand-based satellite access node, SAN 1, As 

40 shown schematically in Figure 1,, SAN 1 is provided with 
an antenna 4 which can track the orbiting satellite;'. 

A number of the satellite accessriodes SAN ,1 , 2, 3, 
etc are connected together to form a backbone network 
5. which is connected- through a number ; of gateways 

45 GW i, 2, 3, etc to conventional- land-based telephone 
networks. .For example, considering the gateway GW1, 
it is connected to a land-based, public switch telephone, 
network (PSTN) 6,- which, permits, connection to be 
made to a conventional telephone set 7. The gateway 

so GW1 is additionally- connected to a.vpublic switch data 
network (PSTN) 8 and a public local mobile network 
(PLMN).9. Each of the gateways GW 1 ; 2,3 may com- 
prise commercially available mcbile switching centres 
(MSCs) of the type. used in GSM networks, 
. 55 - As shown in Figure 1, the handset UT 1 can also 
communicate with the conventional land-based mobile 
network PLMN 9, which ( is shown schematically to 
include a transceiver station 10 that establishes a 



T , '■ 



SNSDOCID: <EP 0869892A1J _> 



7 EP0 869 6 

duplex link 1 1 - with the user terminal UT 1 .'In this exam- 
pie, the PLMN 9 is a GSM networks For a'fuHer under- 1 
standing of GSM, reference is : directed to- the various ' 
GSM Recommendations issued by the* Eurbpe'an Tele- ■ 
communications Institute (ETSI).' Also reference .is 5 
directed to "The GSM System for.Mobile Cbmmunica 1 
tions" by M. Mouly and. M-B. Pautet, supra, 1or a more 
easily understandable synopsis. . . / 

The satellite network is-designed to provide world- 
wide coverage and the satellites' 3a, 3b 'form part of r a 10 
constellation of satellitesr which may be arranged in ! 
several orbits. In one example, two orbits of five satel- 
lites are used, which can be shown to provide coverage 1 
of a major part of the surface of 'the earth,' in which for a 
1 0* satell ite e I evatiofv ang I e , • one r satell ite can be 1 s 
accessed by the mobile handset all ot -the time 1 and two ■ 
satellites can be accessed for. at least 80% of the time; 
tftereby providing system ^diversity. Further- satellites 
may De mciuded in th e " constellation^! 1 ofd er to ; provide " 
adctitonal redundancy and : diversity. >; ■■- 20 

The satellites are typically arranged in a MEO con* " 
steiia&an. to* example with an orbital radius of 1 0,355 
km. although the invention is not restricted to a particu : 
la/ ortrfal radius In this embodiment, satellites '3a, 3b " 
are shown m a common orbit and the satellites are 25 
tracked oy the antenna arrangement of each SAN. Typ- 
ically each SAN includes five antennas for tracking indi- 
vidual satellites of ' the constellation; The SANs are 
spaced around the'earth ih' order td ! provide ; contihuous ■ 
coverage. In the example shown, SAN t may be located 30 
in Europe whereas SAN 2 may be located ih Africa, 1 
SAN 3 in America and other SANs may be located else- 
where. In Figure 1,- the SAN-2 is shown communicating * 
with user terminal UT 2- via satellite -3b. For further 
details of -the 'satellite network,- reference is difected to 35> 
GB-A-2 295 296.^ ' ' ' ; 

The satellites 3a, 3b' are in hon geostationary orbits : 
and comprise generally conventional satellites such as : ; ' 
the Hughes HS 60 T and may include features disclosed 1 ' 
in GB-A-2 288 913. Each satellite'3a, 3b is arranged to 40 
generate an array of beams covering a footprint- on the 
earth beneath -the -satell ite, each beam including a 
number of ''different frequency channels and time slots 
as described in GB-A-2 -293-725. The beams thus pro- 
vide adjacent cellular areas -which' 1 correspond to the 45 
cells of a -conventional land-based mobile telephone 
network. The satellites are controlled 'by means of a sat- 
ellite control centre" (SSC) 12 and a tracking telemetry 
and control station (TT&C) 13, which are connected to a 
network management centre 14 through/a digital net- so 
work 1 5-that is coupled to the backbone network 5. The 
SSC 12 and the TT&C 13 control operation of the satel- 
lites 3a, 3b. e.g.' for setting the transitu ssioh : power lev- 
els and transponder input tuning, as directed by the- 
NMC 14'. Telemetry signals for the satellites' 3a. 3b are ss 
received by the TT&C 1 3 and processed by -the SSC 1 2 
to ensure that the satellites are functioning correctly. 

During a telephone call, the handset UT1, 2 com- 
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municates with the satellite 3a, 3b via a fuH duplex chan-' : * 
nel comprising a down link channel "ande an *up link:;" 
channel. The channels include TDMA time slots on frev ■ 
quencies allocated on initiation of the caH. The satellite " ■ 
link can be used for voice communication' and can also 
be used for satellite digital packet data communication ' 
e.g. at a data rate in a range of 2:4-64 kbps for facsimile, 
text message, e-mail or other packet data transmission 1 '> 
between the user terminal and the SAN. r 'The satellite f 
network thus supports. a satellite digital- packet network* 
(SPDN).,* : .> .... ..>;. i. - }l( : - , . 

Referring to Figure 2, the configuration of : SAN T- * ' 
and the : IOcal PLMN 9'is shown ih more*Jetailr SAN -1 ! " 
consists of -a land earth station HES 1 which is coupled 
ttfthe five dish antennas 4 for tracing the satellites, the "*■■■■" 
LES 1 including transmitter arid receiver circuits with 
amplifiers; multiplexers; demultiplexer 1 and Codec's 1 . A- ; 
mobile satellite switching centre MSSC 1 is-coupled'to ■' '-'--j- - 
LES1 and to a satellite visitor location register VLRs^fl ■: " 
MSSC 1 couples communication signals- (voice and 
packet data) to the backbone network 5 and to the LES - ^ 
1 , so as to 'allow individual telephone calls to be estab- 
lished through: the backbone network 5 and the duplex'- ■ 
communication Hnk 1, 2 via- the- satellite 3a, to -the' ■ 
mobile terminal UT 1. The ^MSSC -1 f responds to~»'-''. 
addresses on incoming communication signals from the 
antenna 4 to route the signals appropriately to their, des- 
tinations. ■ 1 r . r . v . ■ ■ i i . : i ■ . • , ; . . 

The VUR SAT 1 maintains, a record of 'each of -the 
subscribers; namely the IMSlsof- each of the user-termi- 
nals UT that are- making use of the SAN Vfof signal 
communication. 

Additionally, in order 'to control the flow of packet " 
data signals around^the SPDN, each SAN is provided' 
with a mobile data intermediate station MD-IS, 1 -- as- 
shown for the SAN 1 in Figure 2. Theoverall flow of dig-- 
ital packet data in the satellite network is controlled by a 
network administrator NASS which may conveniently be 
located at the NMC '14, as shown inFigure 1-. : - ■ " ' ' 

The MSSC 1 is connected to the gateway GWVso 
as to provide an output connection to<PLMN 9, together. ' . 
with PSDN 8 and PSTN 6 shown in Figure 1 . Thus; typ- 
ically, the packet data will be fed to and from the PSDN> 
8 and voice signals will be communicated to" and from" ' - 
the network PLMN 9 'or PSTN It will be 'understood' * ^ 
that all -the SANs are of : similar -construction with a ' ■ 
respective VLR SA Y'to maintain a record of the subscrib- ' 
ers registered. --re...- ... - \* . ->i 

Referring to Figure 3,' the satellite network also "' 
includes a database 1 7 referfed to herein as the" satellite - ~- 
home location register (HLRg AT ) that contains records ■■: 
relating to 3ach mobile usen terminal- UT • The" ^ record & ■ 
includes the terminal's identityi'rtafnely, its IMS I, 'the cur- ' : 
rent status of the UT, namely whether -'it-is* operating an ^ . 
in a "local" or a "global" mode^as will be described in - 
greater detail below, the geographicaf location of the UT.t ' 
the home MSSC with which the UT'is'registered, so as^ ■ 
to enable billing and other data to be cpllected at a siri-< .*«-.- • - 
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gle point and the currently active SAN with which the , . Mobile user terminal 
UT is in 'csbmmunication^a^ a satellite. The HLR S at 17 . 

may be located at the NMC 1 4 shown in Figure 1 or may Referring to Figures 4 and 5, the mobile user termi- 

be distributed 1 among 'the 'SANs 1/2, 3 etc. ; " nal UT 1 is configured to operate with both the local ter- 

Referrirj<3 to Figure 1, the UT T may be registered ' s restrial cellular network and the satellite network. Thus, 

with one of 'two ^distinct statuses: ; lpcai;*1h which the UT ' in the example shown in Figure 2, the mobile handset 

is permitted to communicate" oniy through one local ; * UT 1 can operate either according to a tand-based GSM 

area or part ; of the' satellite rWtwork, and "global" which' ' J - protocol or" according to the' satellite'network protocol, 
entitles the UT to communicate through'any part of the, ''" As shown in Figure 4, 'ihe^iiser terminal UT-1 comprises 

satellite mobile network, so as to provide global usage/ io~ a mobile handset which is capable of dual mode opera- 

' - 1 1 * ' tiori. It includes conventional GSM circuits for use with 

GSM Network (PLMN 9) " " : 1 J the land-based cellular network 9 together with similar 

' ' " " drcuitry for use with the satellite network. The handset 

Referring' again to Figure 2.\ the'GSM/ mobile het-^ r 1 comprises a microphone 20, a speaker 21 , a battery 22, 

work 9 includes' a; number *6f '"base transceWer stations^ is' a keypad 23; an antenna 24 and a display 25 which can 

BTS 1 , 2, 3^etc which' are, geographically spaced i apart w be'used amongst other things, for displaying messages 

in order to support a cellular network in a manner well <: ' transmitted to the terminal over the digital packet data 

known ; perse. typically, the GSM network has a cover- ' • - network; via the satellite link. The handheld unit UT1 

age area that overlies a country or* state, and 'is thus' ' also includes a ; subscriber -'identification module (SIM) 

overlaps witr? the* f global coverage of the satellite net- ' hd" smartcard 23- The. circuit corrfiguration of the handset 

work. BTS 1 is shown with an associated antenna 10, " T UT 1 is shown in block diagrammatic form in Figure 5. 

connected by a landiirie'to a base switching centre BSC The SIM card 26 is received in an SIM card reader 27 

1, it bein£ understood that a plurality of 'BTSs are con- " coupled to a controller 28, typically 'a 'microprocessor, 

nected.to BSC 1 in a manner welj known peruse. The The microphone and speaker 20, 21 are coupled to a 

BSC lis connected to a mobile switching centre MSC 1 , 25 . codec 29: coupled to a conventional radio interface 30 

which canVoute tails within the mobile network and aisb ' connected to the ^antenna 24 so as to transmit and 

through a gkteway GMSC 1 to a -conventional PSTN ' receive communication signals, in a manner well known 

over line 18^or to the satellite Yietwork/ over line' 19 " perse. : ' ■ . «:v 

through %e gateway GW 1: Thus, Voice channel calls/' v As shown h Fig. 6,; the-SIM card 26 includes a 

can be routed through the GSM network to and from UT so memory M t which- sto'res an individual IMSI together 

1. However, the GSM' network does' not sbpRorfdgitaf^* : with an identification functi6ri' ; Ki which is unique to the 

packet data transmission to 'aMffom.thVuser terminal SIM, and the algorithms A3/A8; and A5 in accordance 

UT1. * ' ? : - ■ ' wfth the GSM Recommendations. ' :! l " 

A home location register HLR for the land-based . 

GSM network 9 is provided coupled to the GMSC 1 . The '35 Network selection ' ■ "" 

HLR, in . a conventional manner, keeps a record of the ; 1 * 

IMSls of the user terminals registered for use with the ' As described ' previously, the networks can be 

network and details of the' subscribers associated with ; selected in a number of different ways, either atrtorriati :: 

the IMSls for billing purposes. The PLMN -9 may also '''''' cally depending on factors such as signal strength or 

include' a Visitor locationregister VLR which maintains^ 40 manually.' ; ln this'example, the Networks r are selected 

record 1 of subscribers temporarily registered with the ' manually by using a key on the keypad 23'. 
network, that have roarne<j 'from other GSM networks.* When the keypad 23 is operated to select the satel- 

For exarftple; if the PLIvIN 9 is sited in the UK,.subscrib- lite network, the controller 28 operates to configure the 

ers from GSM networks in another country 'e.g. Ger- [ ' codec 29 and the radio interface 30 to a frequency and 

many may be locally .registered on a temporary basis ' 45 protocol and transmission frequency appropriate for'the 

whilst in tnVOK. In 'a conventional manner, telephone satellite network. A voice transmission channel can be 

usage. information' is relayed from the VLR through the ' " selected for the satellite network. Additionally, a digital 

PSTN 6 to the German network for billing purposes. ~- data packet service can be selected through trie SPDN 

An" authentication 'centre AuC* is coupled to the u e.g. according ib the CDPD protocol used hitherto in : US 

HLR. the AuC includes a database of Ki ; s'"that are '''so AMPS networks. Thus, when the satellite network is 

uniquely associated with .the IMS Is df individual sub- selected, both voice chanrieland packet data communi- 

scribers, together with 1 the' algorithm A3/A8 in accord- cation takes place over the duplex links 1 , 2 via the sat- 

ance witrv the GSM recdmm'endatibns, and a random eflite3a. 

number 1 geheratoK This stored' data is used. to authenti- When the PLMN 9 (GSM network)' is selected, the 

cate a user terminal ^sucrY as Wje' terminal UT 1 , as will ' 55 controller 28 sets the radio interface 30 to operate at a 

be explained in moW-Seikil hereinafter. frequency suitable for the land-based GSM network 

' ' voice channel over the' duplex link 11. The 'GSM net- 

r 1 < ' .. .. work however cannot itseif support a digital packet data 
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Network interworking ? .. 

Referring again to Figure 2, the, satellite network 
may comprise the ICQ™ system which can provide, 
enhanced services not available through a conventional . 
GSM or other land-based cellular network, In this exam- 
ple the GSM network 9. cannot itself support a PDN. It : 
will in some circumstances therefore be desirable to use 
the satellite network as an extension of the PLMN .9 so 
as to route calls from the land based mobile, network 9. 
through the satellite network and make use of the addi- 
tional services available through the satellite network 
An interworking function unit 31 is provided for this purr . 
pose, permitting full control oyer the service provision, 
between the satellite and cellular .land-based networks, -.. 
thus allowing e-mail and other packet data services to 
be supported by the GSM network, by using the satellite 
network. -r, ■ ; ~. :■■ \ ■ - ;t 

Authentication procedure . 

As previously mentioned, when the user terminal 
UT 1 is switched -on,, it needs to register with the netr 
works that are to be used for communication purposes 
and an authentication procedure needs to be carried 
out in order to determine the authenticity of the user ter- 
minal. .For the GSM network. (RLMN. 9) .a conventional, 
GSM registration and authentication .procedure ■is : .car- 
ried out which will be explained in more detail hereinaf-- 
ter with reference to Figures 7 and 1.1. 

In accordance with the invention, it has been appre- 
ciated that this conventional GSM registration, proce-^ 
dure can also be adapted for providing authentication of 
the user terminal fpr use with the satellite packet data 
network SPDN and three examples of how the authenti- 
cation , procedure can be used ^yia the SPDN will ,be 
explained .with reference to .Figures 8, 9 and 10 in com- 
bination with Figure 11. The r GSM registration , ancl 
authentication procedure will firstly be described with 
reference to Figure 7. . < 

1. GSM Network (PLMN.9) \ : 
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As previously .mentioned, the user terminal UT 1 
includes, a SIM smartcard which stores a unique IMS I, a 
unique identification function Ki.and a GSM encryption . 
algorithm A5,, according to the GSM Recommendations 
(Figure 6). The registration and authentication proce- so 
dure involves transmitting the (MSI to the GSM authen- 
tication centre AuC and comparing data from the SIM 
with data fromthe authentication centre AuC at a check- 
ing station .35. Iq the conventional GSM authentication 
procedure. the checking station 35 is located within the v 55 
GSM network and may be located at MSC ,1 . 

Figure 7 illustrates the data flow between the vari : . 
ous components of the GSM network and the user ter- 



minal UT, 1 . The steps of the authentication procedure 
are set out in Figure 11. ', .... 

In a first step S1 , the IMS I is transmitted from UT 1 
via BTS 1, BSC 1 and MSC 1, to the HLR,. where if is" 
routed to the authentication, centre AuC, As previously 
mentioned, the "authentication centre AuC includes a 
copy of the identification function' Ki associated with 
each respective IMSI. which is valid for use 'on the G&M 
network. 

At step S2, the IfvlSI is checked' in the memory of 
the AuC, and a corresponding value of Ki .is retrieved. 
Also, a random number RAND is generated in the AuC 
using the random number generator (not shown). The 
random number" RAND and the value of Ki are applied, 
in the AuC, as inputs to the.GSM algorithm A3 to gener- 
ate a signed result SRES. The AuC also includes the r 
GSM algorithm A8 which generates a secret key Kcjhat 
is used for encryption/decryption 'of data transmitted, 
over the air between the user terminal . and the land-] 
based network. In. practice, .the algorithms A3/A8 may 
be constituted by a single, algorithm producing a .96* bit . 
output of which 32. bits constitute, SRES and the.remain^ 
ing 64 bits constitute Kc. ' 

At step S3,, a 'triplet pf signals .comprising RAND. 
SRES and Kc is Jed from the authentication centre AuC, 
through'the HLR to the MSC, which, acts . as checking, 
station 35 in the authentication procedure. \r) practice;/! 
triplets are Supplied to the MSC for use in subsequent, 
authentications, for, example p'uring." a,. : call, but trW' 
processing of only one triplet will.be considered, herein 
in order to simplify the explanation. ; J . ' \\ V 

At step S4, the individual value of RAND" Is trans- 
mitted on to the user terminal through the network from 
the MSC. The SIM of the user terminal UT I stores the 
algorithm A3/A8 so that, at step S5, a 'corresponding 
value of. SRES' is generated at the user terminaVUJ 1 . 
from the received value of the random, number RAND 
and the stored value of Ki in the SIM. . , ' r 

The. value of SRES' is. transmitted back at step S6' 
through. the network to the 1 MSC and compared at step 
S7 with "the originally generated value of SRES. If they 
are the same, the user terminal is authenticated butpth- 
erwise registration of the user terminal with the HLR is, 
barred. 

If the authentication is successful, the MSC initiates * 
encryption/decryption of , data transmitted over the, net- 
work, using an algorithm referred to. in the GSM, Specifi- 
cations as A5i 'which uses as its inputs! the secret key 
Kc and the frame number of data transmitted through 
the network. The encryption arid decryption may actu- 
ally be carried out at the BSQpr pjS., The. SIM of the" 
user terminal LIT 1 generates its pwn, value of the; secret 
key Kc using its locally stored copy .of the algorithm" A8. 
The local value of Kc at the user terrfiinal UT 1 can then* 
be used to encrypt/decrypt data^. .using; a locally held 
copy of the algorithm A5. 

It will be understood that only essentially random 
numbers are transmitted over the air interface, which 
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have novrejation to^one : another,* wh?ch minimises, the , 
risk of cloning or unauthentioated. use. 'jr- : & 

In accordance with the invention, it has been appre- 
ciated that 'this general technique can'also be used to - 
authentica^e : the ; SPDN as wilhriowbe explained.- ■ •* o 

2. Satellite Digital Packet Network Authentication v 

2.1 First Embodiment , v ^ . m . : 

Referring to Figures, 8. and 1 1 ,;the data flow for 
authentication of the SPDN .will' now.be explained. The 
authentication; procedure makes use of .the IMS! -from 
the SIM and also the stored values of Ki held in the AuC 
of the GSM network PLMN 9.;The procedural steps :are is 
gene* ally the same. as those shown in= Figure T1 but in 
thus cas«. the checking station 35 comprises the NASS. 

In or derrto authenticate the user- terminal UT 1 for 
use with SPDN. at step SI, the IMSI is transmitted via 
satellite. 3aar«j MD-IS 1 (associated with SAN a) via the so 
NASS (associated with NMC 15).-.and is routed via GW; ; 
1 (Figure:!} to PLMN 9, the. IMShbeing. directed to the,. 
HLR and ftteiAu€.;as shown . schematically,-^ Figure 3.* ^. 
Then, as- explained »rrth reference to Figure 7, step S2; 
the IMS! «s checked in the memory of the AuC and if 25 
valid, a corresponding value of-Ki is derived from the ■■. 
memory Also, an individual value of RAND is gener- 
ated, and: the algorithm A3/A8 operates on- RAND and 
Ki, to produce jSRES; and- Kc. .,v ^ r :< v -r •&>.., r\ ^ 

Then .at. step:S3,f-thertriplet SRES; ; -Kc and : RAND 30 
are transmitted from the AuC to the checking station 35, 
namely the NASS. . i ^ , ,1, ";: : r h •• - 

At step S4, Ihe- individual value, cf RAND is. trariS- 
mitted back through the network, via saiel'ite 3a to the 
user terminal UT 1 where,- at step-SS, a corresponding 35 
value of SRES' isroenorated as previously described 
with reference to Figure 7. At step S6, the generated 
value of iSRES' is transmitt&d back vi£ satellite 3a and 
MD-IS 1 to the NASS for comparison v/ith the value of 
SRES in the triplet previously .received from the HLR of 40 
thePLMN;3. - i. : f v - if 

At step S7, the values; of , SRES and. S RES' are 
compared, and. if they are -identical ; the user terminal is 
authenticated for use with the SPDN. 

Thus, the procedures described with reference to 45 
Figures 7 and 8 allow the user i3rminal to be authenti- 
cated for either the PLMN 9 or the SPDN selectively, so 
that the user terminal can be used;for vo:ce communica- 
tion over the :GSM network, . narneSyvPLMN -9, a^d for 
packet data'communication over, the network SPDN, via so 
satellite 3a'r. . r- • rvM- 1 .-^,\. ;r - ~ 

It will be understood ^that.ths authentication, proce- 
dure may be repeated during transmission, for example 
when the system hands;.ovenfrom one /Communication , 
cell to another and the;other (n-1) tripic4s can be used 55 
for this : purpose. -.c- r ^hr-. : \\ r ! ■ " 
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2.2 Second Embodiment j;^ 3b/^ ssi 

Referring to- Figure -9, the authentication process 
shown in' Figure 8 csn be.modified.se- ihat the checldng - 
of SRES and SRES! (step S7) is "Carried out at the inter-.- 
working function unit IWF shown in Figure 2. Tne IWF 
thus acts as the checking station 35. Figure 9 illustrates 
the data flows for use in this- embodiment. The value,, of 
SRES and»the corresponding value of SRES' sre pro- 
duced in the same way as described vvith reference to 
Figure 8 (steps S1-S6) tut the comparison of the signal 
values (step S7) Is carried out at the !WF. r 

2.3 Third Emb odiment , ; : . 

■■ -i ■< < ? r- ' . "- . 

The function of the checking station 35 can also be 
performed at the MSSG-1- in the . appropriate SAN (Fig- 
ure 2). Reierring to. Figure 10, the. corresponding data- 
flows for the 1 authentication procedure :s ; shown. The 
: value of SRES and the corresponding value; of SRES' 
are produced as previously described and are sent to 
MSSC =1 for .comparison, so as to authenticate the user 
terminal I JT -1; for. use wrth-ttie. SPDN, ; ■ .,: - 

When both voice and; packet: data trsnsmission is. 
carried out entirely through the satellite network, over 
the links 1,2 and the PLMN 9 is not selected, the termi- 
nal will'be.,autherrticated by. means of ;m authentication 
centre (not shown) associated \vith the HLRs AT shown 
inFig.t. ~ li. . u - ■ 

Many other modifications fall within the scope of the 
invention. For example, it will be understood that the 
PLMN 9- could be- opijra^!e r on- a^number ;i of different: 
standards^ and protocols e.g.-? PHSj PDC in Japan, or 
DCS 1800 in certain European. Countries or -the newly 

prOpOSSd. UVTS. ;-^> - ^ - ^ , • . 

Also; - whilst the- invention, has been described: in 
relation to; the ICOT"; satellite network, .other, satellite 
networks could be 'used with different satellite constella- , 
tions and signal transniissipn prctocols. .-■!,<■- j 

Also, whilst the signal oommunicaticn.on-the paths.- 
1, 2 utilises a TDMA access protocol. ;0t^s^ protocols 
could be used such as code division multiple access 
(CDMA) or frequency division multiple access (FD MA). 

Althcrjh for the sake of convenient explanation,- the 
term "mobile" has b^en used to: denote the user termi- 
nals UT, it should be understood that this term is not 
restricted, to hand-held; or hand, portable . terminals but 
includes for example terminals : to be -mounted on 
marine vessels or aircraft; or in terrestrial /ehicles/ ASso, 
it is possible to practice the invention with some of the 
terminals UT being completely or at least partially 
immobile. . 

Claims ; 

1. A method, of authenticating a mobile user terminal 
for. use. with a.first;or,a :£econd mobile network pro- 
viding .coverage in., -a common area,- wherein. the 
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user terminal is operable according to *a 'pfKletfer- munication with a mobile network which uses a pre- .: . . . 

mined authentication procedure which makes use determined authentication procedure , for the voice , . > 
of anjndividuaJ identification code hetei in. the user c channel, the procedure. making use of an individual 

terminah and a; corresponding identification code: .-.-r; ■ identif icatipn .code held in. the user* terminal and a 

held at a remote authentication centre;, the method !: . s'\ ■ , corresponding identHication cede held at a location ■ ; e 

comprising: ! *i ...-'.s ~'< ,f )t. ; ■■•.„. p-. : in the network that provides the voice channel, the 

• t ^-2 ..ini^^j ■ f>!^ .l ? ~" *. i. method^comprising : ; . : ? • *-jyv *. ?, (;. -> - ^ 
^accessing the authentication centre through av- " ,i -r 

. selected' one of the networks- to retrieve accessing the mobile network that provides the 

authentication data" cbfresponding to the identic 1 -to-'J voice channel, from the digital packet data net- 

fication code 1 stored' 1 ^ the 'use'r terrninafTand' "- ^ ■■ [■ ; '-work ' to: 11 retrieve. Authentication . -data corre-; ~* 

performing ah authentication of the User termt- > o^ondingtothe-identification icbde held at said & ■ 

nal for the selected network, using the authen- .location in . the mobile network that provides the'' -y > 

tication data retrieved from the authe^tication•.' , "■' - vbicerchanhel;and - ' . v< r c 

centre and data from the user terminal. is ^performing;an authentieatiorirof the usenterfhi^^ 

i c ;t- . f ^ nal in'the digital packet data network, using the- * .. * 

2. AmethGdaccordiRgtoclainff l-whereirithefirgtnet-: authentication data"' retrieved fr k om *the' mobile* .: * ^ 
work 'supports transmission of * signals in 1 a- first * - hetwdrk anoVdata from the mobile termiria>: ^ - 
mode and the second network Supports' transmis- ± - :.t =■ -s ,--<r. ■ --r r ' : 

sion of signals in a second mode^ . ~ v ~r kc v 2C'--B. -A method according .to. claim 7' wherein- the digital' r: ■' 

1 er r'j .->'* : :- ! < , packet data-network utilises a satellite communica- . 

3. A method i accordingly claims wherein the first tion link tbihe Mobile userterminal, arid the voice T \ 
mode signals comprise voice dhannel- signals, andi; channel isprovidedby a land based;public mobile 

the second mode signals comprise digital* packet^ ' network. -i~ \ . .1 < ■ .- *• . - -« .. 

datarsignals- - -<>:.:■ ^ . ^ . 25*- . . \> -> -■ \; . \?. s ' 

. . i; : 3i<9. A method according to claim 7 or 8 including:* v. ' - 

4. A method accoroBng £ to* any ' preceding claim i;v ^ • ~'>i>\„ <'■ VI '. : - -.-j.: 

wherein the first network1sfi«atellite telecommuni- o ■■■■=- .;transmittfng;Mdentificatibri data corresponding' 

cations network and the second network is a'- to the identification code stored at the usenter- 

PLMN. y -s- • * ■ - : c \r 'tw. V30 " rhfnal, from/^he. terminahto-the. digital <packet < 

e ■ ':-;.-v : ;-" .•• ■ v ; .r. t.^/.' x'. data network; Civ- 0. : ~. *. 

5. A method of authenticating, a mbbiie'user terminal 1 routing the identification data from tfie ^digital ; 1 ■ 
for use with afirst ; mobile network.-wherein the-user- ^t, packet data 'network to an authentication cen- 
terminal is'6perable*with a:second -mobile network " trainthe vofde network; - - ■■ "'c- > 

providing coverage in a common area with the-first-v<35^; * deriving the- authentication ' data from, .the/ c-:-: 

network and which uses : a predeterrntfied authentic ' . authentication centre in response to the'-ideriti- ■ 

cation procedure for the user^termirial, the ^roce- -r- ^ksationrdata; i v^r.- ir ~ : \, • ;v 

dure making use of an individual identif ieatidn code * interrogatingihe mobile tetminal for dataxorre- ^ 

held in the user terminaland a'cormsporidingiiden- ' • sponding to'authentication'datarahd '■> 

tification code- held at a location irt thfr-secorrd* net- 40 comparing- data derived from the 1 terminal in :^ 

work, the ^ methoct ; comprising^^ - - ' i[ " - . response to the interrogation, with the authen- - . r 

: .. ^ -t> .. . -o. tication data; to determine whetherthe terminal - 

accessing =the second' networks from ' the first may be used on the ;digital > packet data- net?- ■ " 

network to .retrieve'aftithentication data G2>rre-» work. e V, . ■ L- 

^spondir^g to the identif icatiorv code held at said " 45 '■>? ' : . t *i. .-.-n" 

Mocation in the second network; and ' 10. A method.according to" claim 9-includin'g: - ":":'•*• •■ 

^perforrhing'an:authentiCationof the user termi- 3* ..»i-v^ • j ( V; I 1 v;. r -v. H- r.-, 

nal in the first network;-Xisihg; the authentication routing the: authentication data to >a checking •.' 

data retrieved from the second network and location'in'fhedigttal'packetdata'n'etwork; and ; *■' 

data from the "mobile terminal: : -.j5o . corhparing the data derived from the terminaMn: 

"! . -■■■-*:, response to the interrogation, with the authen- .: ; 

6. A method according to claim 6 wherein the first net- - tication data,- at the chedkiri^location. i. : - 
work is a satellite telecommunications network and **■: - - - : l" * . ' • : ; . . -.*■.■' 
the second network is a PLMN. '-^ 11. A method according to.clalm^a^or^lO-'wherein the ~. 

55 ■ ' mobile terminal stores said ■individual identification . 

7. A method of: authenticating a' mobile user terminal code and an individual identification function,- and . \. \ 
for use with' a digital padket data network, wherein the authentication centre also includes said identif i- 
the-user terminal is operable fbr voice channel com- ■ cation code and said individual identification tunc- 



r 



9 



17 EP 0 869 692 A1 

tion. 

1 2. A telecommunications system including: 

at least part of first and second mobile net- 5 
works providing coverage in a common area for 
communication with a mobile user terminal 
operable according to a predetermined authen- 
tication procedure which makes use of an indi- 
vidual identification code held in the user io 
terminal, . 
an authentication centre that includes authenti- 
cation data corresponding to the identification 
code stored in-the user terminal;- 
means for directing .data from the user terminal 15 
corresponding to the- identification code either ! 
from the first network or- the- second network to 
the authentication centre to retrieve the 
authentication data corresponding to the identi- • - 
fication code; and * ' * 20 
means for performing an -authentication of the 
user terminal for the, selected network, using 
the authentication' data retrieved from the 
authentication centre and data from the user 
terminal: ' . , ' 2s . 
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